101–110 of 151 posts
very cool! might i recommend creating a config for dnscloak?
But yes, NextDNS should provide something that's ready to copy-and-paste.
Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. A few suggestions: - Auto-detect OS and suggest specific setup instructions right on the landing page? - The website goes blank when I block third-party JavaScript from loading. Can you please see if you can fix that? - simplednscrypt has been handy for me to DoT/DoH/DNSCrypt with AdGuard…
> Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. Running your own private recursive resolver is very easy. Edit: I believe people are confusing running a DNS nameserver with running a DNS resolver. The former might be hard, the latter is very easy.
Earlier quoted context omitted.
According to my nextdns analytics from the last few weeks my house has peaked at around 28,000 queries a day, 331k so far this month. Nextdns is blocking somewhere in the region of 400-600 queries each day, mostly things like Google Analytics, Apple iAd.
5 people household here with 15 devices (iPhones, iPads, PS4, Raspis & Chromecasts) DNS via PiHole: 138,473 queries over the last 30 days 31,928 queries blocked (23%) Hope this helps.
Earlier quoted context omitted.
> Nice. DNS has grown notoriously complex over the years and it is hard work to run a standards compliant service. Congratulations. Running your own private recursive resolver is very easy. Edit: I believe people are confusing running a DNS nameserver with running a DNS resolver. The former might be hard, the latter is very easy.
No. Its not. You need to buy hardware, set it up and later constantly maintain it. It requires technical knowledge, willingness to do it and, above all, free time. While initial investment may seem trivial, on the long run it's not. People very often tend to forget that own solutions are not set up and forget. This is why cloud services are a thing in a first place.
If you run e.g. Linux or BSD, you'd just install knot-resolver, enable the service and put "127.0.0.1" in your /etc/resolv.conf. That's it.
Similarly if you run something like pihole it is very easy to have it run a recursive resolver as well, I bet pihole has a page on how to set that up, and I doubt it is hard in any way.
If, of course, all you have now is a router provided by your ISP and you want to run your own intranet DNS resolver, then, yeah, you'll probably need some hardware for that. Obviously.
[+] some networks hijack outgoing DNS.
Bypasses Turkish government blocks on Wikipedia etc, which I hadn't been able to figure out even with google/CF over HTTPS. Awesome!
oh wow I had no idea about this: https://en.wikipedia.org/wiki/Block_of_Wikipedia_in_Turkey
https://en.wikipedia.org/wiki/Recep_Tayyip_Erdo%C4%9Fan#Elec...
And forget about reading up on the faux coup d'état.
https://en.wikipedia.org/wiki/2016_Turkish_coup_d%27%C3%A9ta...
I don't understand why any privacy conscious person would choose a hosted service instead of self-hosting your own solution. Implementing the whole thing (modulo the anycast IP, which is the only thing I did not use) is easy. I have a docker-compose file which does the whole stack: 1. Unbound DNS which provides DNS-over-TLS service at port 853. It forward request to my local pihole's 53 port. 2. Pihole forward reques…
Earlier quoted context omitted.
Is your source code open? This looks really cool. I'm nervous about entrusting someone with stuff as sensitive as DNS. If this is all it appears to be, I may be a paying customer (tho I try to only use/pay for free-as-in-speech software).
>I try to only use/pay for free-as-in-speech software I would like to see more software adopt this model. Can you give a few examples of things you support? Are they all pay-for-hosting services, or are there cases where the software itself is for sale?
A strict interpretation would suggest something along the lines of "we don't censor what the customers of our software do with it", which is true for almost all software (aside from social media platforms). I don't see how this would apply here, since this software isn't being used for the creation of anything.
A looser interpretation would suggest that, if the software is used to access content (eg. web browser) then, aside from technical limitations, it doesn't censor content that it could otherwise display. I can see how this might apply to a DNS.
I don't see, however, how "free-as-in-speech" has any reference to open or closed source. (Not sure if that was what was meant.)
I was going to implement pi-hole for a non-profit organization I may use this instead.
This is a service I've been looking for! But... Why do you need a shitton of javascript to load your main page? I cannot see the main page with ublock origin + umatrix blocking 3rd party and firefox finger print resistant options turned on.
Earlier quoted context omitted.
Your solution is not privacy conscious or self-hosted as long as you send all your data to Google in exchange for resolved DNS records. Why not let Unbound resolve recursively?
I think it depends on who you're trying to protect against. While using DoT to a public resolver gives the public resolver the ability to build a history of your queries, running a recursive resolver yourself means anyone who's watching the wire (ISP, local government, etc.) can build a query history instead. Some people trust Google or Cloudflare more than those other entities, or figure that Google already knows pr…
So because a snooping provider is irrelevant when we talk only about resolving DNS, that only leaves the choice of which party to the chain of entities that are able to easily snoop on your or not. If privacy is important, adding Google or any other DoT resolver to that chain is strange.